Posted
by
timothyon Thursday April 29, 2010 @03:22PM
from the you-can't-enter-our-theme-park dept.

An anonymous reader writes "The Register reports that the Chinese government is forcing vendors to cough up the source code to their encryption alogrithms before they can sell their equipment to the Chinese government. The EU doesn't seem to like it, but if I were in their position I'd want the same thing."
China's biggest neighbor goes further; another anonymous reader writes "Telco equipment from China could have spyware that gives access to telcom networks in India. The Indian government has officially told mobile operators not to import any equipment manufactured by Chinese vendors, including Huawei and ZTE. The ban order follows concerns raised by the Home Ministry that telecom equipment from some countries could have spyware or malware that gives intelligence agencies across the border access to telecom networks in India. The biggest gainers from the move could be Ericsson, Nokia, and Siemens, which have been losing market share to aggressive Chinese equipment-makers in India."

are the ones that are open to peer review. So Kudos to the Chinese for being smart enough to make these idiot companies with closed-source encryption technologies provide them with the source code for review. Good encryption does not rely on obfuscation of code and processes!

Regardless of whether that's why they want to view it or not, the net effect is that only robust algorithms will be exported to China. Everybody can get the code to GPG, but that doesn't make the keys invalid.

The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations. Why should this be any different? There are expert groups in China who will find vulnerabilities in the systems and then, instead of having to have trojanised equipment from their own vendors, they will be able to attack the other vendor's equipment just as well.

What's really funny is that India is stopping buying Chinese made teleco equipment whilst other countries like the US; also great friends of China (when will you stop blocking their discipline against the rebel province of Taiwan???) still continue to buy Chinese.

No, it's actually quote logical. You see, for Western countries, China is a nominally communist "bad guy" that conveniently serves as an example of what the opposite of their idea of "freedom" would be. In practice, they're too distant for this to cause any change in behaviour, and buying their cheap products seems to keep the plebs happy. OTOH, India and China are highly populous nuclear armed mega-countries that share a disputed land border (see Arunachal Pradesh) - that warrants a degree of caution when dealing with each other.

Google's services aren't running on windows, but their office staff are and that's where the point of entry was... Once you start keylogging workstations it doesn't really matter how secure other servers are.

The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations.

What does one thing have to do with the other? What have you been smoking?

Why should this be any different? There are expert groups in China who will find vulnerabilities in the systems and then, instead of having to have trojanised equipment from their own vendors, they will be able to attack the other vendor's equipment just as well.

Great, so let's make all encryption algorithms secret. Security through obscurity has worked sooooo well in the past...

What's really funny is that India is stopping buying Chinese made teleco equipment whilst other countries like the US; also great friends of China (when will you stop blocking their discipline against the rebel province of Taiwan???) still continue to buy Chinese.

Can India afford that, or are they just bluffing? And why do you think it's your job to "block" a sovereign country on an internal issue? Would you like the Chinese to "block" you if California wanted to become independent? Mind your own fucking business!

What does one thing have to do with the other? What have you been smoking?

The break in to google was based on a windows / IE vulnerability which was otherwise unknown. Looking through articles about it it's pretty clear it ends up as "state actors" from China. In other words, exactly they people MS gave source code access to.

Great, so let's make all encryption algorithms secret. Security through obscurity has worked sooooo well in the past...

Or how about using one of the standard open source well studied implementations? What's wrong is the idea of giving the source code to China and leaving all other users in the dark.

Can India afford that, or are they just bluffing?

The can't afford not to. China and India are in a state of more or less co

Regardless of whether that's why they want to view it or not, the net effect is that only robust algorithms will be exported to China.

Oh dear, the second logical fallacy of the day. That I've noticed.

The article (not that I've read it) does not imply this ; the most that the article implies is that the only firmware algorithms that will be accepted by China will be those that it's code reviewer(s) think are robust. And there is no guarantee that the reviewers will be competent for this task (this is not to

smart enough to make these idiot companies with closed-source encryption

It's often overlooked that GSM development started in 1982. At that time computing power was a fraction of what it is now and DSPs, rather than dedicated logic used in today's chipsets, would be used for the first implementations of this new technology. Mobile phones are also very power sensitive devices - battery life is very important.

So given these pressures, some corners had to be cut to make the system workable on the available

are the ones that are open to peer review. So Kudos to the Chinese for being smart enough to make these idiot companies with closed-source encryption technologies provide them with the source code for review. Good encryption does not rely on obfuscation of code and processes!

I'm not disputing your premise, but adding a rider- sending your source code to somebody who has no intention of telling you about the holes they found (and might be planning to abuse them instead) won't help you or your other customer

Not just backdoors, i have seen implementations of encryption with serious weaknesses...

I saw a commercial encryption product which used an off the shelf 128-bit AES implementation (and their marketing literature made a big point of saying it used AES), but due to the way it derived a key from your entered passphrase there were only 2^21 possible keys making it trivially easy to brute force.

Another package i saw used OpenSSL to handle encryption, which seems sensible - use a known good set of algorithms...

This seems like a natural progression down the line of diminishing trust between countries. It's not very surprising, especially since the Chinese government *may* have been 'supportive' of some of the China/Google hacking. It appears the downside of possibly endorsing or supporting security breaches is other people/countries/etc will suspect you of it from that point on.

I can't blame the Chinese government for wanting to have the encryption information... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.

I'm just reminded of the old security-oriented definition of Trust: the person you trust is the person who can break your security.
It's a perfectly healthy attitude to trust people (/businesses/nations) as little as possible when the security of your data is at risk.
In arena of IT security, we need less "trust" and more "verify".

This seems like a natural progression down the line of diminishing trust between countries. It's not very surprising, especially since the Chinese government *may* have been 'supportive' of some of the China/Google hacking. It appears the downside of possibly endorsing or supporting security breaches is other people/countries/etc will suspect you of it from that point on.

You might also consider that if they are spying on their own citizens via spyware installed by the manufacturer (at government insistence), they realize fully well that it can be done to them via software or equipment from sources not under their control. No need to invoke the Google hacking - that was just a sloppy fiasco. The government hacking "bay of pigs", if you will.

This seems like a natural progression down the line of diminishing trust between countries.

I could just as well see it as a progression reflecting increasing levels of economic interdependence. Granted, economic interdependence isn't quite the same thing as trust - it's more substantial; it's trust expressed through actions.

I can't blame the Chinese government for wanting to have the encryption information... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.

What about the domestic producers of encryption equipment? Don't they stand to gain a little through sales to their government, whether it be India, China, or the U.S.A.?

For my part, I don't understand why any government trusts producers of other countries for their critically sensitive information. In the U.S., we know that our "friends", like Israel, engage in espionage, and I'm pretty sure we spy on them (although I have no evidence to back it up other than fuzzy recollections of news articles

Domestic publishers could insert backdoors too... The government should be demanding source code for review in all cases, and verifying that the devices they get are actually running the source they've seen.

China has a very bad track record when it comes to copyright protection and the production of knock-off products. It is true that software is only part of a product, but there's no need to make it any easier for them.Chinabashing it may be, but mindless it sadly is not.

Unless the source can be compiled from scratch and used in place of the pre-compiled versions, including flashing of firmware, creation of installable ROM images or OS installs, having source code guaranteed by analysis to be exploit-free gains the user nothing. There could still be spyware in the final product. Short of self-installing, I guess creation of bit-equivalent or checksum-equivalent binaries would be good enough as a verification mechanism.

Unless the source can be compiled from scratch and used in place of the pre-compiled versions, including flashing of firmware, creation of installable ROM images or OS installs, having source code guaranteed by analysis to be exploit-free gains the user nothing. There could still be spyware in the final product. Short of self-installing, I guess creation of bit-equivalent or checksum-equivalent binaries would be good enough as a verification mechanism.

It should be common sense that you have to verify that the source code you were given actually compiles to a bit-identical executable in order for the exercise to mean anything at all.

Yes, but that's not always the case, even with nominally "Open Source" software that ends up on proprietary closed devices. Tivo comes to mind, as does Android. I can't recall ever reading about building bit-identical executables as a way of verifying that what is running on the hardware is actually the same as the audited source code. Mostly I read the opposite - what actually runs is always different from what the 'open' source can produce, if for no other reason than signing them with a private key. That's enough to slip in some clever assembler routine that can be used as a backdoor, I'm guessing.

I think China's move makes sense - they just want to check and make sure there is no backdoor in your code/algo. As an earlier post said "Good encryption does not rely on obfuscation of code and processes." They trust what the users want to encrypt, just making sure the devices are not leaking the info to uninvited parties.

As for India, this is very bad. They are just paranoid. This sets up a very bad example. They are scaring off all the business partners and hence the opportunities. Think if you are a vendor, how can you be sure that they would never do the same thing to you one day?

but Indian goverment is not buying the stuff. It's the telecom operators that buy it and use it to sell services to regular citizens. The goverment could buy trusted equipment for their needs.

The teleco stuff is the stuff you will use to call for help and communicate during a war. Since the idea of total war [wikipedia.org] it has been clear that your civilian infrastructure may be targeted in war. The idea of something which lets your opposition remotely disable most of your industrial capacity is crazy. That's what Chinese exchanges represent for India.

well it's strange because we are talking about servers that "could have spyware or malware". Wouldn't it be easier to actually search for the spyware and come forward with some proof?

When checking that a medicine is not poisonous, what you'd do is to look at what's in it. It's much easier to check a list of ingredients, and test those if necessary, than to check it against every harmful substance known.

In the same way, when checking a program for malicious content, it's best to look at the source code. How

we are not talking about the same thing. A dongle it's not really part of the telecom network; it is user equipment. Why bother selling compromised dongles when you can buy a dongle for any network you want and do whatever with it?

I have worked in the defense industry for a while, and used to work in the "Government" division of a major telecom company.

One project we had worked on was encrypted cell phones for gov use. Our customers were only interested in a solution that was top to bottom US made from cleared companies. The chipset, OS, drivers, etc, were all built in the US, so there was no issue of "back doors"

I also heard rumors at one point about some contractor actually finding mal-ware type SW embedded in the firmware of Lenovo laptops that could sort of call home to momma. I've never seen Lenovo boxes around after that.

I think these issues are going to be bigger than just a single point in the infrastructure chain. With so much cyber activity going on, I think many countries are going to face the same sort of issue India is trying to prevent.

Glad to see you mention the vulnerabilities that can be introduced via the chipsets...a lot of people focus on the code and don't understand what you can do with a single chip - and "invisibly", for all practical purposes.

First off, TFA article doesn't mention source code; second, it quite explicitly says 'details are murky' and it is unclear what the PRC is asking for. At least as far as the article goes, that is what is said.

Second, to some comments: Other countries already have various schemes in place for reviewing code (which doesn't preclude flaws or backdoors, intentional or not, from being included in compiled / embedded code...)

India is saying what other countries fear, but since they are in China's backyard and v

The idea that corporations that bowl over the largest nation states is our future has always seemed strange to me. Multinationals are really just a legal fiction that exists simultaneously in multiple countries. At any time, a political system can create problems that will effectively bring that multinational to its knees.

I think the future for big business is identical, only a little further out, to that of big government: replacement by small, agile businesses. Big business exists mainly because of big government and cooperation between the same. I think we're going to see a future in which each major country may trade for some tech products, but you'll see conditions begin to favor agile, much smaller businesses that can efficiently produce most important things at home.

see conditions begin to favor agile, much smaller businesses that can efficiently produce most important things at home

I tend to disagree; while conditions may differ elsewhere, our Supreme Court's transformation of corporations into super-citizens will in fact encourage corporations to become ever bigger so as to ever better afford the purchase of both political advertising and politicians. Given enough political control, a corporation can simply and effectively modify the rules of the game to make "doing business" prohibitively expensive or complex unless you are already of sufficient size.

And they will do that; the important thing to remember is that our corporations have grown themselves to the size that they are now for the competitive advantage that size provides in the pursuit of profit; they do not, in fact, like competition, and size provides more and better opportunities to eliminate competition.

The headline suggests that China is using import rules to bolster security. I think it is the other way round. They are using the demand for source code as a barrier to trade to (unfairly) help domestic firms. Not very many overseas firms are going to provide source code, leaving the market open to Chinese firms.

The headline suggests that China is using import rules to bolster security. I think it is the other way round. They are using the demand for source code as a barrier to trade to (unfairly) help domestic firms. Not very many overseas firms are going to provide source code, leaving the market open to Chinese firms.

I would agree with you if you didn't say "(unfairly)".Access to source code is a legitimate security concern. Fair trade doesn't mean that you can't set high standards if foreign providers can't reach them.

in the 80's and 90's American manufacturers gave away their technology to the Chinese to get a piece of the huge Chinese market. This allowed the Chinese to modernize their manufacturing technology by decades in a few years. Then instead of opening their markets, China flooded the world markets and decimated the foreign competition.One might hope managers of corporations would learn from the past...

I think ALL governments should behave this way. If government is to take its own data security seriously, the boxes they use should not be "black boxes." For commercial business this should also be a rule but so far, business trusts closed source software and devices running on closed source software... well, not all businesses... not Ernie Ball... not London Stock Exchange... but most businesses.

At some level, we have to trust technology though... seriously, I don't know what's in the Linux kernel. I

just having access to the software source is terribly inadequate to address security concerns. a kill switch can be easily implemented in hardware as a tiny, insignificant chip. now if you are going to have every single piece of equipment reviewed by hardware experts, then ok. but i dont think that is practical.

I think India isn't doing the restrictions for Trust or Security reasons. Their politicians couldn't care less. For the right price, they will sell you a state or two.

It probably has more to do with keeping knock off China phones off the markets to keep the big corps happy. In India, there is rampant import of Chinese knockoff phones. An HTC becomes a HIC. They add a little line at the bottom and cut the price from $400 to $50. I kid you not. Quality control is an issue, but if you have the right connections, that won't be a problem. The phone is from the same factory that makes the name brand, its the same materials, same machines, and same people. Just the 3rd shift of lineman and it doesn't go through QC before shipment.

So for sometime, the India government has been pressured to put a stop to this import. They haven't been very successful but that doesn't mean they don't look like they are trying. Exactly how do you stop 50 individually owned stores stuffed into an area the size of a CVS from selling the same stuff to a population that creates a massive amount of demand but isn't willing to pay like credit based Americans are. Not to mention your enforcement divisions are willing to look the other way for a dollar of that $50 sale. Additionally, the worst offenders are the politicians and those connected to them.

I think India isn't doing the restrictions for Trust or Security reasons. Their politicians couldn't care less. For the right price, they will sell you a state or two.

sadly true for many state governments. but i think the government at the center is not that corrupt. this really is a security concern. the problem is that we don't have the kind of expertise to review each device individually for secret, kill-switch, call-home chips.on the other hand china requiring source code won't do much about security, since it is easier to incorporate a tiny chip. imo, this is simply about not having to develop their own software.

So India is worried about backdoors in products from China, but is not worried about backdoors being present in products from other countries?They should be worried about any proprietary products from any country... China isn't the only country that might want to spy on India.

It is one thing to have something that is labeled ''source code to the product'' and to be sure that this is exactly what was used, eg no little extra ''tweak'' hidden in a system macro that leaves a security back door. If they are serious about this they will insist on compiling the source on one of their machines and check that it matches the binary that is shipped with the product.

All of this is a lot of work and will take a lot of time, who is going to pay for it ?

Why do obnoxious dumbasses like you bring up poverty everytime India does something good or aspires for something that only developed countries has 'rights' to? A developing country cannot aspire to have security and be able to defend itself from commie and islamic terror neighbours? Cant it become self-sufficient in space, defence and other technological advances? Because it is poor, the entire populace is doomed to live in 15th century?